Re: port-i386/52404

[Robert Elz <kre%munnari.OZ.AU@localhost>]

The following reply was made to PR port-i386/52404; it has been noted by GNATS.

From: Robert Elz <kre%munnari.OZ.AU@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: gnats-admin%netbsd.org@localhost
Subject: Re: port-i386/52404
Date: Thu, 05 Apr 2018 16:45:49 +0700

 Unfortunately a loti of things can touch user mailboxes - looking to be
 able to say "you have mail" is a common feature long running interactive
 processes tend to like to support - essentially all shells can do this
 for example, so can gkrellm (and probably a whole bunch of other
 similar monitoring programs, desktop environments, and similar - for all
 I know, emacs might do it as well, it does everything else possible on
 the system...)
 
 I doubt that postfix is related, nor the mail reading programs (though
 they are not impossible - something like thunderbird is probably
 constantly monitoring so it can announce when new mail is available,
 other long running mail programs (user agents) may be similar).
 
 None of these (except mail delivery, and actually accessing mail to
 read/reply/delete etc) should cause the mailbox to be altered in any
 way at all - but bugs in any of them could do just about anything.
 
 What you probably need to do for this, is monitor the mailboxes looking
 for when one changes (it is certainly not ls that is incorrect here, if ls
 says the mod time is 1 Jan 1970 (ie: (time_t)0) then that is what it has
 been set to - by something.
 
 When you see a mailbox has changed, look and see what processes the
 user who owns that mailbox, and what root owned processes are running.
 
 Keep doing that for a while, and when you have enough data, look for what
 is common (and might be something which could be looking at users' mailboxes)
 
 When you have a suspect, use that yourself and see if your mailbox gets
 affected.     If you can find which process is likely doing this, let us know, 
 and we might be able to work out why - but without knowing what is running
 on your system that might be poking at mailboxes, and doing things to them,
 there is little else we can do - neither the filesystems, nor ls, randonly 
 change the times of files.
 
 kre
 
 ps: it would also be useful to see the output of
 
 	mount | grep mail
 
 the output from df is kind of useful, but does not reveal the
 interesting information.   I doubt we will learn anything from
 this, but it is possible.
 
 pps: to gnats-admin (dholland I presume) - this PR ought to be
 moved out of port-i386 to somewhere more rational...